Method for performing safety checks on a modular safety controller

Abstract

The invention relates to a method for performing safety checks on a modular safety controller (1) having a plurality of electronics modules (10.1-10.n) in which safety functions for the safe operation of at least one machine (2), which is connected to the modular safety controller (1), are implemented, wherein all safety checks to be performed are carried out, acknowledged and logged after completing the checks.

Description

Procedure for conducting a safety audit of a modular safety controller

[0001] The present invention relates to a method for carrying out a safety check of a modular safety controller which has a plurality of electronic modules in which safety functions for the safe operation of at least one machine or technical plant connected to the modular safety controller are implemented.

[0002] Modular safety controllers are known in various forms from the prior art. They serve, in particular, to safely bring machines or technical systems into a state that is safe for humans when a hazardous situation occurs. For this purpose, corresponding signals from signal transmitters, such as emergency stop switches, emergency stop switches, light curtains, light barriers, safety mats, safety door position switches, 3D laser scanners, etc., are received and reliably evaluated on the input side. On the output side, one or more safe output contacts of an output circuit are activated. These output contacts control actuators, such as contactors, valves, etc., when a hazardous situation occurs, in such a way that a connected machine or technical system can be brought into a state that is safe for humans.

[0003] Such modular safety controllers comprise several electronic modules arranged in at least one module row, each with specific functionalities. The modular design of a safety controller allows for application-specific configuration by individually assembling, wiring, and configuring multiple electronic modules to meet the modular requirements. Safety controllers jointly provide the desired safety functions. Examples of electronic modules from which modular safety controllers with very different safety functions can be built include input modules that can receive and, if necessary, process input signals from one or more signal transmitters, such as input signals from sensors or emergency stop devices; output modules that can output signals to one or more connected actuators; combined input and output modules (so-called I / O modules); control modules that can control the assignment of input to output modules; as well as interface modules, communication modules, fieldbus controllers, fieldbus couplers, etc.

[0004] A modular safety controller can be configured by a user, for example, using a configuration tool with a graphical user interface. This allows the user to select the electronic modules required for the specific application of the safety controller from a wide range of available modules. The configuration is then stored in a configuration database as a configuration record, which includes not only the module information but also information about all safety functions of the modular safety controller.

[0005] In the manufacture of a modular safety controller, the electronic modules are arranged in a series of at least one module based on the configuration data set, wired accordingly, and configured so that they can provide the functionalities required for the specific application from a safety perspective.

[0006] After the modular safety controller has been installed at the place of use, it is necessary to carry out a safety check to ensure the correct functioning of the safety controller when interacting with a connected machine or technical system.

[0007] EP 3 499 324 A1 discloses a method for verifying the configuration of a safety controller. The configuration is created on an external input device, such as a computer or smartphone, and transferred to the safety controller. The implemented configuration is displayed on the input device so that a user can confirm it. The configuration is divided into sub-configurations, which are then verified.

[0008] The invention aims to provide a method for carrying out a safety check of a modular safety controller, by means of which the check process can be carried out by a user in a particularly simple, intuitive and safe way.

[0009] The solution to this problem is provided by a method having the features of claim 1. The dependent claims relate to advantageous embodiments of the invention.

[0010] An inventive method for carrying out a safety check of a modular safety controller, which has a plurality of electronic modules in which safety functions for the safe operation of at least one machine connected to the modular safety controller are implemented, comprises the steps S1) Establishing a communication link between the modular safety controller and a test device that has a provides a human-machine interface, 52) Providing a configuration data set that is processed by the test equipment and contains information about the electronic modules and the safety functions of the modular safety controller implemented by the electronic modules, 53) Generating a test data set with a plurality of predefined, sequentially executable user instructions for testing the functions, in particular the safety functions, of the electronic modules, 54) Visualizing one of the user instructions, executing the user instruction in question, and confirming the execution of that user instruction. 55) Recording and confirming at least one machine intervention resulting from the execution of the user instruction in process step S4), 56) Repeat steps S4) and S5) until the execution of all user instructions and all resulting machine interventions have been confirmed, 57) Automatic generation of a digital test report from the confirmations of the executed user instructions and the resulting machine interventions and storage of the test report together with a unique identification identifier of the safety controller in a non-volatile storage device.

[0011] Using the method according to the invention, a user is guided through all the necessary steps in an automated process, similar to a digital checklist to be processed sequentially. The required safety checks of the modular safety controller were performed. The execution of all user instructions and the resulting machine interventions are automatically logged and saved, and can therefore be included in the system. The form of the digital test report should at least constitute a part of digitally accessible machine documentation.

[0012] The term "machine interventions" shall be understood here to mean all reactions of the machine or technical system connected to the safety control and its actuators and signal transmitters to the execution of the user instructions specified by the test data set.

[0013] The test device can be, for example, a computer, in particular a laptop, a tablet computer, or a mobile phone (smartphone). The test device executes appropriate test software, by means of which parts of the method according to the invention are carried out. The test device can optionally be configured to also execute a software-based configurator for configuring the modular safety controller and / or to program the modular safety controller.

[0014] In a preferred embodiment, it is proposed that the user instructions be visualized by means of a display device at the human-machine interface. This allows the user instructions to be understood and implemented by the user in a particularly simple manner.

[0015] In a particularly preferred embodiment, it is proposed that the execution of user instructions and machine interventions be confirmed by the user through input into an input device of the human-machine interface. In this way, all instructions executed by the user that trigger machine interventions are acknowledged.

[0016] The human-machine interface can, for example, include a touch-sensitive display device with an integrated input device. This makes operating the human-machine interface particularly simple and intuitive.

[0017] In one embodiment, it may be provided that at least some of the user instructions include setting potentiometer positions of the electronic modules and / or reading preset potentiometer positions of the electronic modules and / or triggering at least one signal transmitter.

[0018] In one embodiment, it is possible that the machine intervention resulting from the execution of the user instruction in process step S4) is detected by the user and confirmed via the human-machine interface.

[0019] In an alternative embodiment, it can also be provided that at least one machine intervention resulting from the execution of the user instruction in process step S4) is automatically detected and confirmed by means of the modular safety controller. This confirmation is then preferably transmitted to the test device via the communication link.

[0020] In an advantageous embodiment, it is proposed that the test data set is automatically generated from the configuration data set by means of the test device.

[0021] To further simplify the execution of the procedure, one embodiment may provide that the communication link between the modular safety controller and the test device is established by scanning an optoelectronically readable code attached to the modular safety controller using a camera. The test device is initiated. This embodiment is particularly advantageous if the test device is a tablet computer or a mobile phone (smartphone) with an integrated camera. The optoelectronically readable code can, in particular, be a two-dimensional code.

[0022] In one embodiment, it is possible that a replacement verification is performed when one of the electronic modules is replaced.

[0023] The procedure presented here for carrying out a safety check of a modular safety controller makes it possible, in particular, to check all potentiometer settings, wiring and safety functions of the modular safety controller. Further features and advantages of exemplary embodiments of the invention are described below with reference to the drawings. These show: Fig. 1 shows a schematic representation of a system for performing a safety check of a modular safety controller. Fig. 2 is a schematic representation illustrating the basic process.

[0024] Before details of a procedure for performing a safety check of a modular safety controller 1 are explained below, the basic structure of a modular safety controller 1 will first be described with reference to Fig. 1. The modular safety controller 1 is connected to at least one machine 2 (or technical system) which has at least one actuator 20 and at least one signal transmitter 21. An example of a machine 2 that can be operated by means of the modular safety controller 1 is an industrial robot.

[0025] A machine 2 often also has several actuators 20 and several signal transmitters 21, which are connected to the modular safety controller 1. In many applications, several machines 2 are connected to and controlled by a single modular safety controller 1.

[0026] The modular safety controller 1 has a plurality n of electronic modules 10.1-10.n, which are arranged in at least one module row and are electrically wired to each other and connected to the machine 2. The first electronic module 10.1 preferably forms a central control module of the modular safety controller 1 and is often also referred to as the head module. The remaining electronic modules 10.2-10.n are selected from a variety of different electronic module types specific to the application. These remaining electronic modules 10.2-10.n can be, for example, input modules that can reliably receive and, if necessary, process input signals from one or more signal transmitters 21, such as input signals from sensors, alarm devices, or emergency stop devices; output modules that can reliably output signals to one or more connected actuators 20; combined input and output modules (so-called I / O modules) that have inputs and outputs; as well as interface modules, fieldbus controllers, fieldbus couplers, etc. The number and type of electronic modules 10.1-10.n usedn depends directly on the planned application and purpose of the modular safety controller 1 and in particular on the level of safety to be achieved.

[0027] In general, the task of the modular safety control 1 is to safely switch off the actuators 20 connected to the modular safety control 1 when a dangerous situation occurs, which is detected by at least one of the signal transmitters 21 - i.e. by at least one of the sensors, alarm devices or emergency command devices - and to reactivate them after the end of the dangerous situation.

[0028] At least some of the electronic modules 10.1-10.n of the modular safety controller 1 have one or more potentiometers 11.1-11.n, in particular detent potentiometers, by means of whose electrical resistance values ​​relating to functions, in particular safety-related functions, of the modular safety controller 1 and the machine 2 connected to it. These effects are adjustable and can also be changed. For example, the switch-on and / or switch-off delays of machine 2 can be set or changed using potentiometers 1 1 . 1 -1 1 . n.

[0029] For the sake of simplicity and to avoid over-complicating the following description, it will be assumed, following this general functional description of the modular safety controller 1, that an actuator 20 and a signal transmitter 21 of a single machine 2 are connected to the modular safety controller 1.

[0030] Depending on its intended use, the modular safety controller 1 is configured by a user, preferably using a software-based configurator. The configuration process can, for example, be carried out using a web-based configurator. The configuration of the modular safety controller 1 is stored as a configuration data record in a non-volatile memory device 3 and is retrievable. The modular safety controller 1 is manufactured based on the configuration data record, which contains all configuration information. The potentiometers 11.1-11.n can be preset during manufacturing to simplify the subsequent installation of the modular safety controller 1 at the point of use.

[0031] After delivery of the modular safety controller 1 and its connection to the machine 2, it is necessary to verify the safety functions of the modular safety controller 1 before starting productive operation. This verification of the safety functions is carried out using a test device 4. The test device 4 can be, for example, a stationary computer or a portable computer, in particular a laptop computer, or a This could be a tablet computer or a smartphone. Using the test device 4, appropriate test software can be executed, which assists a user in verifying the safety functions of the modular safety controller 1 and ensures that all required safety checks are performed, acknowledged, and logged upon completion. The test device 4 can optionally be configured to also execute the software-based configurator and / or program the modular safety controller 1.

[0032] The testing device 4 has a human-machine interface 40 that enables interaction with a user performing the safety check. The human-machine interface 40 has a display device 41 by means of which information and data of various kinds can be visualized for the user. Furthermore, the human-machine interface 40 has at least one input device 42 by means of which the user can make various user inputs. The display device 41 can be designed to be touch-sensitive – particularly when the testing device 4 is implemented as a tablet computer or smartphone – so that the functions of the at least one input device 42 are integrated into the display device 41.

[0033] In this case, the configuration data set of the modular safety controller 1 is stored decentrally in a non-volatile storage device 3 designed as cloud storage. In principle, the configuration data set of the modular safety controller 1 can also be stored elsewhere. Non-volatile storage media that are integrated into the test device 4 or accessible via an interface should be mentioned in this context. to be connected to test equipment 4, at least temporarily. Furthermore, the configuration data set can be stored on a local server, which test equipment 4 can access via a wired or wireless network connection.

[0034] The test device 4 is designed to read and process the configuration data set that defines the configuration of the modular safety controller 1 in order to generate a configuration-specific test data set. This test data set includes the user inputs required during the safety check of the modular safety controller 1, such as the settings of the potentiometers of the electronic modules 10.1–10.n of the modular safety controller 1 to perform the safety check. If the potentiometer settings, which are primarily detent potentiometers, have already been configured by the manufacturer of the modular safety controller 1, the test data set may include information about the target positions of the potentiometers.

[0035] With further reference to Fig. 2, details of the procedure for carrying out a safety check of the modular safety control 1, which is connected to at least one machine 2, will be explained in more detail below.

[0036] In step S1, a communication link is established between the modular safety controller 1 and the test device 4. This can be a wired or wireless communication link. Establishing the communication link between the modular safety controller 1 and the test device 4 can For example, the test device 4 can be initiated by scanning an optoelectronically readable code 12, which is attached to the modular safety controller 1, using a camera 43. This makes establishing the communication link particularly simple and intuitive.

[0037] In step S2), a configuration data set is provided to the test device 4 by accessing the storage device 3. This data set is processed by the test device 4 and contains information about the electronic modules 10.1–10.n and about the safety functions of the modular safety controller 1 implemented by the electronic modules 10.1–10.n. The configuration data set can, for example, be stored in the non-volatile storage device 3 together with a unique identification identifier of the modular safety controller 1, in particular a unique serial number.

[0038] In step S3, a test data set is generated containing a plurality of predefined, sequentially executable user instructions for testing the safety functions of the electronic modules 10.1–10.n. Preferably, the test data set is automatically generated by the test device 4 from the configuration data set of the modular safety controller 1, which was previously read in by the storage device 3. The sequentially executable user instructions, in the form of a digital checklist, specify to the user how the safety check of the modular safety controller 1 is to be carried out.

[0039] In step S4), one of the user instructions is visualized by means of the display device 41 of the human-machine interface 40. The user instruction in question is entered by the user. Executed. The execution of this user instruction is subsequently confirmed.

[0040] At least some of the user instructions may include setting potentiometer positions of the electronic modules 10.1-10n and / or reading preset potentiometer positions, in particular manufacturer-preset potentiometer positions, of the electronic modules 10.1-10.n and / or activating the signal generator 21.

[0041] The machine intervention resulting from the execution of the user instruction in process step S4) is recorded and confirmed by the user in step S5). Alternatively, it is also possible for the machine intervention resulting from the execution of the user instruction in process step S4) to be recorded by the modular safety controller 1 in step S5) and confirmed to the test device 4 via the existing communication link.

[0042] In step S6), steps S4) and S5) are repeated until all user instructions and all resulting machine interventions have been confirmed.

[0043] In step S7, a digital test report is automatically generated by the test device 4 from the confirmations of the executed user instructions and the resulting machine interventions. This test report, together with a unique identification identifier of the modular safety controller 1, in particular the unique serial number of the modular safety controller 1, is stored in the non-volatile memory device 3 or in another non-volatile storage medium and can be retrieved. The test report then forms part of the machine documentation.

[0044] The procedure presented here for carrying out a safety check of the modular safety controller 1 makes it possible to check all potentiometer settings, wiring and safety functions of the modular safety controller 1.

[0045] In the event of a replacement of one of the electronic modules 10.1 - 10.n, a replacement verification can also be carried out using the procedure.

Claims

Claims: Method for performing a safety check of a modular safety controller (1) comprising a plurality of electronic modules (10.1-10.n) in which safety functions for the safe operation of at least one machine (2) connected to the modular safety controller (1) are implemented, comprising the steps 51) Establishing a communication link between the modular safety controller (1) and a test device (4) which provides a human-machine interface (40), 52) Providing a configuration data set that is processed by means of the test equipment (4) and contains information about the electronic modules (10.1-10.n) and about the safety functions of the modular safety controller (1) implemented by means of the electronic modules (10.1-10.n), 53) Generating a test data set with a plurality of predefined, sequentially executable user instructions for testing the functions, in particular the safety functions, of the electronic modules (10.1 - 10.5), 54) Visualizing one of the user instructions, executing the user instruction in question, and confirming the execution of that user instruction. 55) Recording and confirming at least one machine intervention resulting from the execution of the user instruction in process step S4), 56) Repeat steps S4) and S5) until the execution of all user instructions and all resulting machine interventions have been confirmed, 57) automatic generation of a digital test report from the confirmations of the executed user instructions and the resulting machine interventions and storage of the test protocol together with a unique identification identifier of the safety controller (1 ) in a non-volatile storage device (3).

2. Method according to claim 1, characterized in that the user instructions are visualized by means of a display device (41) of the human-machine interface (40).

3. Method according to one of claims 1 or 2, characterized in that the execution of the user instructions and the machine interventions are confirmed by a user by input into an input device (42) of the human-machine interface (40).

4. Method according to one of claims 1 to 3, characterized in that at least some of the user instructions include setting potentiometer positions of the electronic modules (10.1-10.n) and / or reading preset potentiometer positions of the electronic modules (10.1-10.5) and / or activating at least one signal transmitter (21) of the machine (2).

5. Method according to one of claims 1 to 4, characterized in that the at least one machine intervention resulting from the execution of the user instruction in process step S4) is recorded and confirmed by the user.

6. Method according to one of claims 1 to 4, characterized in that the at least one machine intervention resulting from the execution of the user instruction in process step S4) is detected and confirmed by means of the modular safety control (1 ).

7. A method according to any one of claims 1 to 6, characterized in that the test data set is automatically generated from the configuration data set by means of the test device (4).

8. A method according to any one of claims 1 to 7, characterized in that the establishment of the communication link between the modular safety controller (1) and the test device (4) is carried out by scanning an optoelectronically readable code attached to the modular safety controller (1) using a The camera (43) of the test device (4) is initiated.

9. Method according to one of claims 1 to 8, characterized in that when one of the electronic modules (10. 1 - 10. n) is replaced, a replacement verification is carried out.

Images